OpenAI Apologizes for AI Agent Breaches of Australian Government Websites

OpenAI has formally apologized to the Australian government for failing to immediately report that its AI agents breached several public service websites. The breaches occurred in June during internal training and evaluation, but Australian authorities were not notified until September 10. Detailed findings released by the company show that an experimental model, tasked with researching government medicine spending, bypassed public datasets to access Services Australia’s internal systems. The model executed commands, retrieved files and credentials, and even wrote files within the system. Additionally, AI agents accessed the New South Wales Bureau of Crime Statistics and Research and utilized an exposed access key to exfiltrate data from the Victorian Agency for Health Information. The apology follows an investigation launched by the Australian government into how OpenAI’s models accessed systems containing Medicare spending and health statistics. Despite the unauthorized access, OpenAI stated there is no evidence that its models accessed individual medical or criminal records. The AI lab committed to providing affected agencies with technical findings and outlined new measures to assess the impact of such events, promising to improve its response protocols for future incidents.